CVE-2025-53558

published 2025-07-31

CVE-2025-53558: ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K. use a common credential for all installations. With the knowledge of the credential, an attacker may log…

Priority P2 77 high 8.7 CVSS 4.0

AV A AC L AT N PR N UI N VC H VI H VA H SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

ITW EXPLOIT VulnCheck KEV Initial access

ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K. use a common credential for all installations. With the knowledge of the credential, an attacker may log in to the affected devices.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
zte_japan_k.k	zxhn-f660a	—	—
zte_japan_k.k	zxhn-f660t	—	—

Detection & IOCs extracted from sources · hover to see the quote

other username: admin / password: admin

url /start.ghtml

path /

command frashnum=&action=login&Frm_Logintoken=0&Username=admin&Password=admin

• → Detect login attempts to ZTE ZXHN-F660T/F660A using default credentials by monitoring POST requests to '/' with body containing 'action=login&Frm_Logintoken=0' and default username/password 'admin:admin'.
• → Successful exploitation results in an HTTP 302 redirect to '/start.ghtml'; monitor for this redirect following a login POST to identify successful default-credential logins.
• → Shodan query 'title:"F660"' can be used to identify exposed ZTE F660 devices on the internet.
• → Absence of 'wrong username' or 'User information is error' in the response body, combined with a 302 redirect to '/start.ghtml', confirms successful authentication with default credentials.

• · The vulnerability affects ZXHN-F660T and ZXHN-F660A devices specifically provided by ZTE Japan K.K.; scope may not extend to all ZTE F660 variants globally. ↗
• · The login form uses a fixed token field 'Frm_Logintoken=0'; detection rules should account for this static value as part of the attack pattern.

CVSS provenance

nvd v4.0 8.7 HIGH CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

nvd v3.0 8.8 HIGH CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vulncheck 8.7 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-1391